Sanitised Code Stopping at &

[justlukeyou]

The code I am using designed to display the terms I am using in my search.

 

For example:

 

.php?description=red&purple&widgets displays red and purple widgets.

 

However, I am also echoing the terms so people know what they are searching for:

 

"Your are searching for red and purple widgets"

 

However, by using the & sign it now displays "Your are searching for red"

 

If I using .php?description=red%purple%widgets then nothing is displayed.

 

 

function sanitizeString($description)
{
$description = mysql_real_escape_string($description);
$description = stripslashes($description);
$description = htmlentities($description);
return $var;

[Pikachu2000]

By using stripslashes() after mysql_real_escape_string(), you're effectively un-sanitizing the string you just sanitized. You also don't need to use htmlentities() to insert data into a database. It would be used when displaying the data.

 

EDIT: You shouldn't use stripslashes() at all without first checking whether get_magic_quotes_gpc() is TRUE.

[justlukeyou]

Thanks,

 

I am displaying data. Products and descriptions etc.

 

What measures would a page like this use so people dont insert code into the URL?

 

http://www.play.com/Search.html?searchstring=b1end&searchtype=clothingall&searchsource=0

[Pikachu2000]

There's nothing you can do to stop people from entering whatever they want in the url string. You have to validate that the data received is at least of the type expected, and sanitize it accordingly.

 

Can you post that code in context with how it's actually being used, and also how you're encoding the values for the url string?

[justlukeyou]

Hi,

 

This is the code.  Am I worrying to much than someone can inject code?

 

<?php

ini_set('display_errors', 1);
error_reporting(-1);



$query = "SELECT * FROM productfeed";

if(isset($_GET['description']) && !empty($_GET['description'] ))
{
$description = $_GET['description'];
$query .= " WHERE description like '%$description%'";
}

if(isset($_GET['price']) && !empty($_GET['price']))
{
$price = explode('-', $_GET['price']);
$lowPrice = (int)$price[0];
$highPrice = (int)$price[1];

$query .= " AND price BETWEEN $lowPrice AND $highPrice LIMIT 0, 15";
}


$result = mysql_query($query);

while($row = mysql_fetch_assoc($result))

{

$id = $row['id'];
$image = $row['awImage'];
$link = $row['link'];
$description = $row['description'];
$fulldescription = $row['fulldescription'];
$price = $row['price'];

echo "<div class='productdisplayshell'>
<div class='productdisplayoutline'>
<div class='productborder'><center>
<a href='$link' target='_blank'><img src='$image' width=\"95%\" /></a>
</center> </div></div>
<div class='productdescriptionoutline'>
<div class='productdescriptionbox'>
<a href='$link' target='_blank' >$description</a>
</div>
<div class='productfulldescriptionbox'>$fulldescription</div>
</div>
<div class='productpriceoutline'>
<div class='productpricebox'>
<center>&#163; $price</center>
</div>
<div class='productbuybutton'>
<center><a href='$link' target='_blank' ><img src=/images/buybutton.png /></a></center>
</div>
</div>
</div>";
} 

if ($_GET['description'] == $description ) {
echo 'Sorry, this product is not available.  Please visit our <a href="http://www.domain.co.uk">Homepage</a>.';
}

if( !$result = mysql_query($query) ) {
     echo "<br>Query string: $query<br>Produced error: " . mysql_error() . '<br>';
}

?>

<?php
function sanitizeString($description)
{
$description = mysql_real_escape_string($description);
$description = stripslashes($description);
$description = htmlentities($description);
return $var;

$price = mysql_real_escape_string($price);
$price = stripslashes($price);
$price = htmlentities($price);
return $var;


}
?> 

[btherl]

No you're not worrying too much   Each variable that comes from $_GET needs to have mysql_real_escape_string() applied to it once and only once.  Then you can safely insert it into your query (inside quotes, as you are doing already).

 

If you don't do that, then your users can gain full control of your database.

 

htmlentities() is used when you want to display data back to the user.  It's not needed before doing an SQL query.  Usually it's used on data you have just fetched from the database.

 

For example:

 

function sanitizeString($string)
{
    return mysql_real_escape_string($string);
}

$description = sanitizeString($_GET['description']);
$query .= " WHERE description like '%$description%'";

 

This is safe.

 

You also need to learn what magic_quotes_gpc is and whether or not it's enabled on your server.

[justlukeyou]

Can I also use "&20" that performs the search and displays search term?

[justlukeyou]

Hi,

 

I'm a bit confused.  I tried this code and still on displays the complete search in the echo if I use %20

 

Is this it should work?

[jcbones]

The ampersand is what separates fields in a $_GET array.  So the way that you have it written with ampersands is most likely not going to work.  You could urlencode the URI, or you could use + signs.